- Demo video: https://youtu.be/82yr6TD27Kw
- Live demo: https://contour-demo.vercel.app/
Deployed addresses used in the live demo and demo video:
- On-chain Proof List for Contracts: https://drive.google.com/file/d/1lgJvjUgCGgw6OUeo2NYmd9mrHO4SdCSG/view?usp=sharing
If you're interested to see the on-chain proofs for Investor A and B from the demo video:
- On-chain Proof List for Investor A: https://drive.google.com/file/d/1Le2yN7xks1f22Q32pTrSTJBmUwV-kNqD/view?usp=sharing
- On-chain Proof List for Investor B: https://drive.google.com/file/d/1odMsfHtb1e439wOBgU4DNSdyxen08gVs/view?usp=sharing
Contour is the product, policy, and agent-coordination layer for Robinhood Chain tokenized equities.
It turns tokenized AMD, AMZN, TSLA, and NFLX into collateralized structured products with market-data-derived terms, immutable onchain termsheets, IPFS-anchored disclosures, ERC-721 position tokens, oracle-priced USDG settlement, and ERC-8001-style agent coordination.
The breakthrough is agent-safe financial execution. Agents can recommend, subscribe, claim, and roll positions, but every fund-moving action must pass an EIP-712 user mandate and PolicyGuard checks for product scope, amount cap, risk limit, action permission, expiry, revocation, signature, and nonce.
Contour makes tokenized equities investable as transparent structured products while making autonomous financial agents safe enough to execute real onchain lifecycle actions.
Tokenized equities are useful, but spot trading alone is not a product layer. Robinhood Chain can carry the asset; structured products still need defined terms, maturity dates, payoff formulas, settlement rules, and servicing logic.
Putting a stock representation onchain solves transferability, but it does not create an investable product lifecycle. A wallet can hold or trade the asset, yet it still cannot natively offer defined-outcome strategies such as downside buffers, capped participation, or coupon-bearing exposure. Without an issuance layer, structured payoffs often remain bespoke offchain agreements. Without a servicing layer, activation prices, maturity prices, claims, and post-settlement reporting often depend on manual operations.
Contour adds the missing issuance, payoff, settlement, and servicing layer on top of Robinhood Chain reference assets.
Structured products need a canonical termsheet before entry. Users should know the payoff formula, loss trigger, cap or coupon, oracle source, maturity, and disclosure hash tied to their position before they subscribe.
A structured product is only as trustworthy as the exact terms attached to the investor's position. If the product page, PDF factsheet, backend database, and settlement engine can drift apart, the user cannot prove which payoff they purchased or which disclosure version applied at entry. This is especially dangerous when two products reference the same stock but carry different coupons, buffers, caps, maturities, or oracle assumptions. The termsheet must be immutable, product-specific, and independently verifiable before funds move.
Contour anchors product terms and disclosures onchain before subscription, so the position token, payoff engine, and factsheet resolve to one verifiable product version.
Hardcoded buffers, caps, and coupons do not belong in a financial product. Terms need a visible methodology and market input.
The economics of a structured product depend on the market regime. A 10-minute Reverse Convertible, a 14-day Buffered Upside product, and a 30-day product should not receive arbitrary terms copied from a configuration file. Volatility changes the value of embedded options and therefore changes the coupon, protection level, and upside cap that can reasonably be offered. If the input data and derivation method are invisible, users cannot distinguish reproducible structuring from a number selected to make a demo card look attractive.
Contour's Pricing Service derives terms from tenor-matched realized volatility on Alpaca historical bars: daily for very short terms, weekly for weekly terms, and monthly for longer products. Buffered Upside receives buffer/cap; Reverse Convertible receives coupon. The methodology is deterministic, reproducible, and never LLM-generated.
Pricing, disclosure, and oracle relay are deterministic services. Suitability, execution, and risk review are agent workflows. Fund-moving authority must be explicit, scoped, revocable, and enforceable onchain — not implied by an offchain role.
Giving an agent a wallet key or a broad approval is not a safe automation model. A Suitability Agent should be able to recommend without spending. A Risk Agent should be able to validate without subscribing. An Execution Agent should be able to move only the amount, for the product, during the time window, and for the action that the user approved. The same distinction matters after entry: auto-claim and rollover should be separate permissions, not hidden side effects of a generic delegation. Users also need an onchain revocation path that immediately removes authority without relying on an operator to honor an offchain request.
Contour separates the boundary cleanly. Suitability is advisory. Execution is mandate-gated by PolicyGuard. Risk validates terms before activation. No agent moves funds outside a signed amount cap, action mask, risk ceiling, validity window, and revocation state.
Contour is a complete vertical slice: market data drives terms; Robinhood Chain reference assets define the underlyings; registries freeze terms; attestations gate activation; the vault settles payoffs; mandates constrain agents; receipts expose each stage.
- Pricing Service reads tenor-matched Alpaca historical bars and derives terms for Robinhood Chain reference assets.
- Buffered Upside: buffer, cap, risk level
- Reverse Convertible: coupon, risk level
- Backend stores a pricing receipt with selected terms, volatility method, reference asset, product type, and rationale.
ContourIssuercreates the product on Robinhood Chain.TermSheetRegistrystores immutable product terms tied to the onchain reference-asset contract.- Disclosure Service generates the product document bundle, pins it to IPFS, and anchors the hash/URI through
DisclosureAnchor. - Pricing/Structuring, Risk, and Disclosure each submit activation attestations with IPFS-backed receipts to
AgentCoordinationModule. - Issuer/operator funds the product's maximum payout requirement in USDG inside
SubscriptionVault.
Most on-chain financial products treat issuance as a single-signer operation. The structurer, risk reviewer, and disclosure officer are offchain roles with no onchain enforcement surface. If any one fails to complete their step, there is no protocol-level gate — just a broken process.
Contour encodes three-party activation approval as a contract-level attestation gate.
AgentCoordinationModulerequires three role-specific attestations before a product can activate- Each attestation is tied to a deterministic product-and-role proof
- Each attestation carries an IPFS-pinned audit receipt, giving judges and users a verifiable trail
- A missing attestation is a contract revert — not a process gap
| Required Attestation | What Must Be Proven Before Activation | Verifiable Evidence |
|---|---|---|
| Pricing / Structuring | Product terms were derived from the approved Alpaca volatility methodology. | Pricing receipt with market input, methodology, selected terms, and rationale |
| Risk | Product terms satisfy protocol risk checks before user subscriptions become active positions. | Risk assessment receipt linked to the product and terms |
| Disclosure | The canonical factsheet and disclosure package were generated, pinned to IPFS, and anchored onchain. | Disclosure hash, IPFS URI, and disclosure attestation receipt |
Product activation succeeds only after all three role-specific attestations, payout funding, and oracle conditions are present.
A. Product-page execution
- User opens a listed product.
- Suitability Agent checks declared constraints, portfolio concentration, requested amount, risk limit, and product terms.
- Suitability result is stored as a product-linked and wallet-linked agent receipt.
- User signs an EIP-712 mandate for the Execution Agent smart account, bounded by the active Suitability Profile.
- If USDG allowance is missing, the user approves the vault once.
- Execution Agent submits the mandate-authorized subscription through Alchemy Gas Manager sponsorship.
PolicyGuardvalidates agent status, mandate scope, amount, product risk, validity window, signature, and nonce.PositionTokenmints the user's structured product position.
B. Recommendation-triggered execution
- Suitability Agent picks one live marketplace product that fits the user's saved advisory profile.
- User clicks Auto-Allocate / Accept.
- Backend records the Suitability → Execution handoff.
- Execution Agent reuses the active signed mandate and submits the subscription through the backend execution service.
- User receives the position without a second wallet popup.
Mandate execution requires a latest passing Suitability receipt for the same wallet, product, and amount. If the receipt is missing or the amount exceeds the suitability-approved amount, the backend rejects before broadcast.
Contour Auto extends both paths into a standing lifecycle mandate.
- User signs and records a Suitability Profile that fixes advisory constraints without granting fund-moving authority.
- User signs a standing Contour Auto mandate with a notional cap, allowed-action mask, risk limit, and expiry.
- Suitability Agent selects eligible live products inside the saved profile.
- Execution Agent subscribes only within the standing mandate, auto-claims matured positions, and rolls eligible proceeds into the next suitable product.
- User can revoke the standing mandate onchain at any time. A revoked, expired, or out-of-scope mandate blocks further execution.
The shipped standing action mask is explicit: Subscribe, Auto-Claim, and Auto-Subscribe rollover. Settlement remains a deterministic protocol lifecycle action called by scheduler/admin infrastructure, not delegated user authority.
The usual onchain structured-product flow is fragmented: product terms live in separate documents, subscription requires multiple manual transactions, and agent checks often remain offchain with no enforcement surface.
The Contour way: one transparent product page, one scoped mandate signature, an Alchemy-sponsored broadcast, and chain-enforced PolicyGuard.
- Structured product subscription requires multiple manual steps
- Terms are externally documented instead of anchored onchain at entry
- Suitability checks are advisory only, with no contract-level enforcement
- Users lack onchain proof of the exact product version they entered
- Agent actions are constrained by convention, not by contracts
- Signed mandates gate only the lifecycle actions the user explicitly authorizes
- Terms, disclosures, and suitability receipts are anchored before entry
PolicyGuardenforces product ID, notional cap, risk ceiling, action type, expiry, and signature onchain- Alchemy Gas Manager sponsors mandate-authorized subscriptions after the vault's one-time USDG approval
- The user's policy envelope is a contract invariant, not an offchain agreement
- A signed Suitability Profile establishes the advisory boundary before an Execution Agent mandate can be created
- Contour Auto adds a revocable standing path for bounded subscribe, auto-claim, and rollover actions
The central insight: agents moving funds without bounded authority are a liability. Contour never asks users to trust an offchain promise that an agent will remain inside scope.
Contour enforces scope at the contract level, not the agent level.
AgentMandateRegistrystores EIP-712 signed mandates: user, agent, product ID, max notional, allowed actions, risk limit, valid after, valid until, noncePolicyGuardenforces eleven conditions onchain before any mandate-gated broadcast succeeds- Users revoke mandates onchain — no operator coordination required
- The mandate model gates shipped delegated actions: subscription, optional auto-claim, and standing rollover. Settlement remains deterministic protocol infrastructure.
- Demo case: attempt a subscription above the signed mandate amount —
PolicyGuardreverts, proving the Execution Agent cannot escape the user's policy - Execution Agent receipts are published through a wallet-scoped SSE stream immediately after persistence, with recovery polling retained as a fallback
Alchemy powers Contour's low-friction execution, lifecycle automation, and user-facing transaction visibility on Robinhood Chain.
| Alchemy Capability | Contour Component or Feature | What It Enables |
|---|---|---|
| Gas Manager sponsorship | Execution Agent subscription flow and Contour Auto | After the vault's one-time USDG approval, the Execution Agent can submit mandate-authorized subscriptions, auto-claim matured USDG, and roll eligible proceeds into the next suitable product within the user's signed limits. |
| Modular Account v2 | Execution Agent and Oracle Relay | Dedicated smart accounts separate trading execution from price updates. Every fund-moving action remains bounded by the user's EIP-712 mandate and checked by PolicyGuard. |
| Alchemy RPC infrastructure | Marketplace, Portfolio, Mandates, and lifecycle services | Contour reads current product state, position state, mandate status, activation updates, and maturity settlement data through one reliable Robinhood Chain connection. |
| Alchemy transfer history | Unified Activity feed | Activity combines USDG transfers, position-token movements, agent actions, and mandate changes into one chronological history instead of showing isolated events. |
| Alchemy transaction receipts | Activity receipt popovers | Users can inspect status, block number, gas used, sender, recipient, and explorer links directly inside Contour. |
Alchemy removes execution friction. Contour's EIP-712 mandates and PolicyGuard still decide whether an agent action is allowed.
Every mandate-based subscription on Contour is Alchemy-sponsored once the vault has USDG allowance.
- User signs and records a Suitability Profile that sets risk and concentration bounds.
- User signs an EIP-712
AgentMandatetyped-data message scoped to a product, notional cap, action mask, risk limit, validity window, and nonce. - If USDG allowance is missing, the user signs a one-time vault approval. Revocation and other wallet-originated transactions may still require wallet gas.
- Execution Agent is registered as an Alchemy Modular Account v2 smart account. Its owner key signs the sponsored operation, and the smart account submits the mandate-authorized subscription.
PolicyGuardvalidates the mandate onchain before the vault accepts the subscription.
From the user's perspective: after the initial USDG approval, subscription becomes a signed mandate plus a sponsored execution. The same mechanism that constrains agent actions makes sponsorship safe: every sponsored UserOperation is bound by a signed maxNotional, allowed-actions mask, product ID, expiry, and risk ceiling that the contract enforces.
Contour Auto extends the same model to standing execution. After approval, Mandates reloads the authorization while the scheduler services it in the background. Convenience never widens the signed envelope.
- Oracle Relay pushes the activation price from Alpaca into
ReferencePriceOracle. - Product activates only after attestations, funding, and oracle conditions are satisfied.
- At maturity, Oracle Relay pushes the final price.
SubscriptionVaultsettles throughPayoffEngine.- User claims USDG.
- Final settlement disclosure report is generated, pinned, and anchored.
- When the user authorizes auto-claim, Execution Agent claims matured USDG inside the signed action mask and records a receipt.
- When the user authorizes rollover, Contour Auto retains eligible cash and allocates it into the next suitable product without exceeding the standing mandate.
Marketplace, Portfolio, Mandates, and lifecycle timestamps are displayed in UTC. Portfolio switches to minute-level countdowns below one hour so the 10-minute demo maturity is visible precisely.
Contour currently supports two payoff templates over Robinhood Chain tokenized-stock reference assets.
| Template | User View | Main Tradeoff | Contract Storage |
|---|---|---|---|
| Buffered Upside | Downside buffer + capped upside | Gives up gains above cap for partial downside protection | bufferBps, capBps, participationBps |
| Reverse Convertible | Fixed coupon + downside exposure below strike | Earns coupon but absorbs 1:1 downside below initial reference price | Reuses capBps as coupon; bufferBps = 0; layout preserved for registry compatibility |
The storage layout is unchanged across both. The same registry, vault, position token, oracle, and settlement flow serve both templates.
Buffered Upside exchanges some uncapped upside for a defined downside buffer. Terms are generated from tenor-matched realized volatility on Alpaca historical bars and validated by the Risk Agent before issuance. Short 1–3 day products use daily bars annualized across 252 trading periods. Medium 4–21 day products use weekly bars annualized across 52 periods. Longer 22+ day products use monthly bars annualized across 12 periods.
The Pricing Service converts annualized volatility into term volatility, then derives a rounded buffer and cap inside protocol bounds:
termVolatility = annualizedVol * sqrt(termDays / 365)
buffer = round_to_5_percent_step(clamp(termVolatility * 1.25, 0%, 30%))
cap = round_to_5_percent_step(clamp(termVolatility * 1.75, 0%, 40%))
For an illustrative 1,000 USDG subscription with a 15% downside buffer and 20% upside cap:
- If AMD rises
30%, the user receives1,200 USDGbecause the gain is capped at20%. - If AMD rises
12%, the user receives1,120 USDGbecause the full gain remains below the cap. - If AMD falls
10%, the user still receives1,000 USDGbecause the decline stays inside the buffer. - If AMD falls
20%, the user receives950 USDGbecause only the5%decline beyond the buffer reduces principal.
Reverse Convertible exchanges uncapped equity upside for a fixed coupon. The same tenor-matched volatility input determines the coupon offered to the user:
termVolatility = annualizedVol * sqrt(termDays / 365)
coupon = round_to_0.5_percent_step(clamp(termVolatility * couponMultiplier, minCoupon, maxCoupon))
At maturity, the coupon is always added to the outcome. If the reference asset finishes at or above its initial price, the user receives principal plus coupon. If the reference asset finishes below its initial price, principal falls one-for-one with the asset decline and the coupon offsets part of that loss:
if finalPrice >= initialPrice:
payout = principal + coupon
if finalPrice < initialPrice:
payout = principal * finalPrice / initialPrice + coupon
Every product is funded against its maximum promised payout before activation. The vault computes the collateral requirement from subscribed USDG notional and the maximum payout above principal:
requiredCollateral = totalSubscribed * (10_000 + capBps) / 10_000
For Buffered Upside, capBps is the upside cap. For Reverse Convertible, capBps is the coupon. In both cases, it represents the maximum amount above principal that the product may owe.
For example, a 1,000 USDG subscription with a 20% maximum payout above principal requires the vault to hold 1,200 USDG before activation: 1,000 USDG from the subscriber and 200 USDG of issuer/operator payout collateral.
Every product generates a five-part disclosure package at issuance. The package is hashed, pinned to IPFS, and anchored through DisclosureAnchor before subscription opens. AgentCoordinationModule prevents activation until Disclosure attests that anchoring is complete.
The content hash of the complete package is verifiable by anyone: fetch the IPFS document, recompute the deterministic package hash, and compare it to the onchain disclosure record.
The factsheet is the subscriber-facing summary. It is generated deterministically from the product's onchain terms and contains:
- Product overview: product type, reference asset, deposit asset, term, subscription window, maturity date, min/max notional, risk level (1–5), and issuer notice
- Product structure: for Buffered Upside — buffer, cap, participation rate, first loss point, maximum return; for Reverse Convertible — fixed coupon, downside exposure description, maximum return, capital protection status
- Payoff description: a plain-English formula stating exactly what the subscriber receives at maturity under each scenario, generated from the actual
bufferBps,capBps, andparticipationBpsstored inTermSheetRegistry - Illustrative payoff scenarios: a scenario table computed by the same formula used by
PayoffEngine, showing investor return at a range of reference asset returns - Key features: product-specific callouts — for Buffered Upside, the buffer mechanics and cap trade-off; for Reverse Convertible, the fixed-coupon-for-downside-exposure structure
- No equity ownership notice: explicit statement that the reference asset is a price reference only — subscribing confers no shares, voting rights, dividends, or claim on any underlying company or Robinhood
The risk disclosure is product-specific and template-populated with the actual terms. It is not a generic boilerplate — buffer percentages, coupon amounts, and worst-case scenarios are computed from the real product parameters.
Product-specific risk section (generated per product type and terms):
- Buffered Upside: buffer limitation (what happens beyond the buffer), cap limitation (what the subscriber forfeits), worst-case scenario computed from actual buffer
- Reverse Convertible: full one-for-one downside exposure, asymmetric risk profile explanation (investor gives up upside in bull markets, absorbs downside in bear markets), coupon-offset-but-not-eliminate language, worst-case scenario if the asset falls to zero
General structured product risks (nine items, param-populated):
Principal risk, capped upside, hold-to-maturity design, oracle dependency, smart contract risk, liquidity risk, concentration risk, regulatory and tax risk, not capital protected
Smart contract and protocol risks (seven items): smart contract immutability, oracle failure, market data delay and source risk (Alpaca IEX data caveats), collateral shortfall risk, network disruption, key management risk (Execution Agent owner key), mandate risk
Jurisdiction section: explicit notices for the United States (SEC registration, FINRA Regulatory Notice 10-09 for Reverse Convertibles), testnet disclaimer, Robinhood non-obligation, and a mapping of traditional regulatory protections to their smart-contract technical equivalents:
| TradFi Requirement | Contour Technical Equivalent |
|---|---|
| FINRA suitability obligation | Suitability Agent check + receipt anchoring |
| Prospectus disclosure | DisclosureAnchor onchain hash |
| Three-party sign-off | AgentCoordinationModule attestation gate |
| Mandate limits | PolicyGuard onchain enforcement |
The T&C is a structured legal document (10 sections) generated from the actual product terms. Key sections:
- Definitions: precise definitions of Notional Amount, Reference Asset, Initial/Final Reference Price, Reference Asset Return, Maturity Date, Buffer/Cap/Coupon, Position Token, Settlement, Payout Amount — all populated from
TermSheetRegistryvalues - Subscription: subscription window enforcement (contract-level), notional bounds, Position Token minting mechanics, agent mandate requirement, no-equity-ownership clause
- Payoff at Maturity: the full payoff formula in plain legal language, split into distinct numbered clauses per scenario — positive return, buffered range, beyond buffer (Buffered Upside); coupon payment, at-or-above-strike, below-strike (Reverse Convertible). Final clause: protocol operator has no discretion over payoff calculation
- Settlement and Claim: who can trigger settlement, how users receive claimable USDG, how position transfer moves claim rights, no claim expiry
- Oracle and Price Determination: Alpaca data source, permissioned oracle relay, oracle failure handling, prices are final and binding, no corporate action adjustment
- Agent Mandates and PolicyGuard: mandate validation rules,
PolicyGuardrevert conditions, subscriber right to revoke, Alchemy Gas Manager sponsorship scope - Risks and Fees: principal risk acknowledgement, no deposit protection, no protocol fee, gas cost disclosure, tax responsibility
- Amendments: terms are immutably anchored at issuance; no amendment possible without a new product instance
- Governing Law: primary governance by smart contracts ("the code is the contract"); off-chain disputes governed by Delaware law; FINRA RN 10-09 acknowledgement for Reverse Convertibles; testnet status disclaimer
The methodology document describes the pricing derivation in full mathematical detail. It is the transparency layer that lets anyone reproduce the product terms from public Alpaca data.
Market data source:
- Alpaca Markets Data API v2, historical OHLCV bars
- Bar timeframe is tenor-matched:
1Dayfor 1–3 day terms,1Weekfor 4–21 day terms,1Monthfor 22+ day terms - Lookback window and observation count vary by timeframe; Closing price field used throughout
Product decomposition (structural economics):
- Buffered Upside: long zero-coupon bond (principal protection within buffer) + long call spread (capped upside) + short put spread (buffer zone). The cap funds the buffer — the subscriber gives up uncapped upside in exchange for defined downside protection.
- Reverse Convertible: long zero-coupon bond (coupon) + short put (downside exposure). The subscriber implicitly sells a put option on the reference asset struck at the initial price. The put premium is the coupon.
Realized volatility formula:
Log Return = ln(Close_t / Close_{t-1})
Variance = (1/(N-1)) × Σ (Log Return - mean_return)²
Annualized Vol = sqrt(Variance × annualizationPeriods)
Term Volatility = AnnualizedVol × sqrt(termDays / 365)
Term derivation from volatility:
Buffered Upside:
RawBuffer = TermVolatility × 1.25
RawCap = TermVolatility × 1.75
Buffer = round_to_5%_step( clamp(RawBuffer, 0%, 30%) )
Cap = round_to_5%_step( clamp(RawCap, 0%, 40%) )
Reverse Convertible:
RawCoupon = TermVolatility × CouponMultiplier
Coupon = round_to_0.5%_step( clamp(RawCoupon, MinCoupon, MaxCoupon) )
The rationale is explicit: higher realized volatility implies more expensive embedded options, which allows the protocol to offer a wider buffer and higher cap. For Reverse Convertibles, a more valuable put premium translates directly to a higher coupon.
Limitations disclosed in the methodology document:
- Realized vs. implied volatility divergence (variance risk premium)
- Lookback sensitivity (recent regime changes not captured after window closes)
- No dividend adjustment in volatility calculation
- Discrete maturity-only monitoring (no continuous barrier)
- Single oracle source (multi-source aggregation is a roadmap item)
- No corporate action adjustments for splits, delistings, or ticker changes
The final section of every disclosure package is the canonical JSON payload — the same structured object whose hash is anchored onchain. It includes the product overview, full terms (all bps values), payoff formula, scenario table, methodology parameters (bar timeframe, lookback, annualization periods, term volatility scale), and the risk disclosure array. Anyone can re-derive the DisclosureAnchor hash from this JSON.
The lifecycle begins after the Pricing Service derives the product terms. The Disclosure Service uses those terms to generate the full five-part factsheet package in JSON and markdown, then computes a deterministic package hash.
The complete package is pinned to IPFS through Pinata. DisclosureAnchor records the content hash and IPFS URI onchain, creating a tamper-evident link between the issued product and the documents shown to users.
The Disclosure Service then submits its activation attestation to AgentCoordinationModule. Product activation is blocked until that disclosure attestation, the Pricing / Structuring attestation, and the Risk attestation are all present onchain.
At maturity, Contour generates and anchors a settlement report using the same pattern. Every stage also produces an agent receipt stored in MongoDB and, where applicable, pinned to IPFS. Anyone can fetch the IPFS document, recompute its hash, and verify that it matches the onchain anchor.
Three agent roles use typed tools to compose multi-step actions. Each result feeds back into the runtime, so agents reason from live portfolio, product, registry, and market state.
Suitability Agent capabilities: evaluates product fit, reads portfolio exposure, explains risk, recommends reinvestment candidates, and selects suitable marketplace products.
Execution Agent capabilities: prepares signed mandates, subscription actions, claim actions, and settlement context while checking agent verification before execution.
Risk Agent capabilities: validates product terms, monitors positions, simulates payoff behavior, explains risks, checks agent verification, and prepares activation attestations.
Protocol services: Pricing Service derives and simulates terms from market data. Disclosure Service generates factsheets, risk text, and attestation artifacts. Oracle Relay updates reference prices and prepares settlement context.
The servicing loop publishes wallet-scoped receipt updates when an Execution Agent action persists. The frontend listens over SSE with recovery polling, so subscription, auto-claim, and rollover receipts surface without manual refresh.
The wallet Activity feed merges four sources sorted chronologically:
- locally recorded agent actions
- locally recorded position lifecycle events
- locally recorded mandate grants and revocations
- onchain USDG, native, and position-token transfers from Alchemy transfer history (soft-fails to empty list if unreachable so the feed never goes blank)
Wallet-scoped streaming updates refresh the feed immediately after receipt persistence, with a lightweight recovery path retained.
Creates structured product instances from approved templates and Robinhood Chain reference assets. Enforces approved payoff types, connects vault/oracle/payoff engine/agent registry/disclosure registry, and tracks product status.
Product lifecycle:
Created -> SubscriptionOpen -> Active -> Matured -> Settled -> Cancelled
Supported types: BufferedUpside, ReverseConvertible
Stores canonical product terms. Every product has its own entry — parameters are never hardcoded. Terms include product type, reference asset, deposit asset, subscription window, maturity timestamp, min/max notional, downside buffer, upside cap, participation rate, risk level, and factsheet hash.
Handles deposits, activation, settlement, and claims. A minimal ERC-7540-style subset for structured products with custom async lifecycle:
Subscribe -> Activate -> Mature -> Settle -> Claim
Subscribed USDG and any issuer/operator payout collateral are held in the vault for the duration of the product term and released to claimants after settlement.
Represents investor ownership as ERC-721 position tokens. Each position has a unique position ID, product slot, notional value, owner, claimable amount, and claimed status. The token behaves like ERC-721 ownership with product-slot and notional accounting layered on top.
Calculates deterministic settlement at maturity.
Buffered upside:
if return >= cap: payout = principal * (1 + cap)
if 0 <= return < cap: payout = principal * (1 + return * participation)
if -buffer <= return < 0: payout = principal
if return < -buffer: payout = principal * (1 + return + buffer)
Reverse convertible:
coupon = principal * couponBps
if final >= initial: payout = principal + coupon
if final < initial: payout = principal * final / initial + coupon
Stores reference prices for activation and maturity. Oracle Relay reads the latest bar close from Alpaca, submits a permissioned update to ReferencePriceOracle, and anchors a JSON receipt hash onchain. Two price points per product: activation price and maturity price.
Anchors product disclosures onchain. Stores disclosure hash and URI, emits disclosure events, and maps factsheets to product IDs. Factsheets and settlement reports follow the same audit pattern: full document stored as JSON, pinned to IPFS, content hash anchored onchain.
| Event | Full document | Proof surface |
|---|---|---|
| Pricing receipt | Volatility input, terms, methodology | MongoDB receipt record + IPFS URI |
| Product factsheet | Factsheet JSON + document bundle | Disclosure anchor record + IPFS URI |
| Suitability receipt | Wallet, product, amount, concentration, judgment | MongoDB receipt record + IPFS URI |
| Oracle update | Asset, source, observed price, timestamp | Oracle receipt record + IPFS URI |
| Activation attestation | Role, product, attestation hash, payload, timestamp | Coordination attestation receipt + IPFS URI |
| Settlement report | Initial/final prices, settlement transaction | Disclosure anchor record + IPFS URI |
| Execution Agent lifecycle receipt | Subscription, auto-claim, retained cash, rollover status | MongoDB receipt record + live wallet-scoped stream |
Anyone can fetch the IPFS document, recompute its hash, and verify the exact artifact against the contract event or public mapping.
Contour separates judgment-based agents from deterministic services so automation never obscures the trust boundary.
| Agent | Lifecycle Stage | User Mandate | Responsibility |
|---|---|---|---|
| Suitability Agent | Pre-entry (advisory) | Required before Execution Agent mandate creation; no fund-moving authority | Checks product fit against portfolio, declared constraints, and product terms |
| Execution Agent | Entry (operational) | Required for mandate execution | Prepares subscription and claim actions; broadcasts only inside the signed mandate |
| Risk Agent | Issuance + lifecycle review | Not required for protocol validation | Validates product terms before activation; lifecycle monitoring is advisory |
The Execution Agent also services standing Contour Auto mandates. It can subscribe, auto-claim, and roll eligible proceeds only when the signed action mask permits the operation and the mandate remains active.
| Service | What it does |
|---|---|
| Pricing Service | Derives buffer/cap or coupon from tenor-matched realized volatility |
| Disclosure Service | Templates product terms into factsheets, hashes them, anchors via DisclosureAnchor |
| Oracle Relay | Reads Alpaca latest bar close and submits permissioned price updates |
| Lifecycle Scheduler | Calls eligible activation, maturity settlement, and servicing loops |
Suitability Agent -> Execution Agent
Suitability checks whether the product fits. Execution prepares and broadcasts only after suitability has passed and the user signs a mandate. The handoff does not grant spending authority — that comes only from the signed EIP-712 mandate.
For standing execution, the same boundary remains intact: a Suitability Profile is advisory context, while a separate Execution Agent mandate is the only source of fund-moving authority.
PolicyGuard validates mandate-gated agent actions before execution:
- Is the agent registered?
- Is the agent active?
- Is the agent verified?
- Is the mandate unrevoked?
- Is the mandate unfrozen?
- Has the mandate reached
validAfter? - Is the mandate still within
validUntil? - Is the action in the allowed action set?
- Is the amount under max notional?
- Is the product risk within the mandate risk limit?
- Are the mandate signature and nonce consumption valid?
Execution Agent subscribes 75 USDG into Product #12.
Mandate max notional: 100 USDG. → Check passes.
Execution Agent attempts 150 USDG into Product #12.
Mandate max notional: 100 USDG. → PolicyGuard reverts.
Requires three role-specific onchain attestations before product activation:
- Pricing/Structuring Service — terms derived from approved Alpaca volatility inputs
- Risk Agent — terms pass protocol risk-limit checks
- Disclosure Service — canonical factsheet generated and anchored
Each attestation is keyed to a deterministic product-and-role proof. If any role attestation is missing, product activation is blocked.
| Contract | Purpose |
|---|---|
AgentRegistry |
Registers approved agents with ID, account, role, metadata hash, active status |
AgentVerificationRegistry |
Stores verification status, risk scores, proof hash, last verified timestamp |
AgentMandateRegistry |
Stores EIP-712 mandates with ERC-1271 smart-wallet validation |
SandboxedAgentWallet |
Restricts agent scope: registered keys only, permitted targets, permitted selectors, max call value |
AgentTrustRegistry |
Maintains trust levels and role-specific trust scopes for agent onboarding |
AgentServiceEscrow |
Supports paid agent services with escrow-funded job lifecycle |
RWAComplianceAdapter |
Emits lifecycle events for every product action and tags flows for cross-system tracing |
SuitabilityProfileRegistry |
Stores user-signed advisory profiles separately from fund-moving Execution Agent mandates |
Robinhood tokenizes the asset. Contour makes the asset programmable.
Robinhood Chain is built around tokenized financial assets. Contour is deployed for Robinhood Chain Testnet (chainId 46630) as the product-control layer that turns those assets into structured products:
- structured payoff templates
- product issuance with immutable termsheets
- onchain ERC-721 positions with defined USDG settlement
- disclosure anchoring
- agent-serviced lifecycle actions
- policy enforcement before agent execution
Contour's canonical products reference Robinhood Chain tokenized-equity contracts directly. They are not disconnected ticker labels: each product starts from an onchain reference-asset contract and adds a Contour payoff template, immutable termsheet, disclosure package, collateral requirement, oracle lifecycle, position token, and USDG cash settlement.
| Robinhood Chain Reference Asset | Contract Address | Contour Canonical Product |
|---|---|---|
AMD |
0x71178BAc73cBeb415514eB542a8995b82669778d |
AMD Reverse Convertible |
AMZN |
0x5884aD2f920c162CFBbACc88C9C51AA75eC09E02 |
AMZN Buffered Upside |
TSLA |
0xC9f9c86933092BbbfFF3CCb4b105A4A94bf3Bd4E |
TSLA Reverse Convertible |
NFLX |
0x3b8262A63d25f0477c4DDE23F83cfe22Cb768C93 |
NFLX Buffered Upside |
The Robinhood Chain contract anchors the reference asset's onchain identity. Contour positions remain structured-product positions: they do not confer shares, voting rights, dividends, or physical delivery of the referenced equity.
Structured products require creation, subscription, activation, oracle updates, settlement, claims, disclosures, and agent validation. Robinhood Chain's Arbitrum-compatible execution makes those recurring workflows practical while keeping the reference assets, vault, mandates, and positions on the same network.
| Standard | Contour Implementation |
|---|---|
| EIP-712 | AgentMandateRegistry hashes typed Execution Agent mandates with product scope, max notional, allowed actions, risk ceiling, validity window, and nonce. SuitabilityProfileRegistry separately hashes signed advisory profiles. AgentCoordinationModule uses typed intents and participant acceptances for coordination. |
| ERC-1271 | AgentMandateRegistry, SuitabilityProfileRegistry, and AgentCoordinationModule validate smart-wallet signatures while retaining ECDSA recovery for EOAs. |
| EIP-5267 | AgentMandateRegistry, SuitabilityProfileRegistry, and AgentCoordinationModule expose typed-data domain metadata so wallets and clear-signing tools can identify the signature domain. |
| ERC-721 | PositionToken represents each subscription as an owned position token with standard ownership, approvals, transfers, metadata, product ID, and notional tracking. |
| ERC-6454 | PositionToken exposes transferability status so restricted positions can respect Contour's transfer controls and destination allowlist. |
| ERC-4906 | PositionToken emits MetadataUpdate and BatchMetadataUpdate when a position or the metadata reader needs an explicit refresh, keeping explorer and wallet metadata synchronized. |
| ERC-4337 | Alchemy Modular Account v2 smart accounts and Gas Manager-sponsored UserOperations power Execution Agent and Oracle Relay broadcasts on Robinhood Chain while Contour contracts retain the final authorization checks. |
| ERC-7715 / ERC-7710 | Private wallet permission and delegation model for agent mandates |
| ERC-8001 coordination core | AgentCoordinationModule implements propose, accept, execute, cancel, status, nonce, EIP-712 intent, participant acceptance, and ERC-1271 validation |
| Standard | Usage |
|---|---|
| ERC-3525 subset | Product-slot and notional-value position accounting |
| ERC-7540 subset | Async subscribe, activate, settle, and claim lifecycle |
| ERC-7821 subset | Batch execution entrypoint for constrained agent-wallet calls |
Contour issues, distributes, and services structured products on tokenized assets, starting with Robinhood Chain tokenized equities. The business is lifecycle infrastructure: value is created at issuance, entry, execution, servicing, settlement, and audit — not only at trade entry.
| Customer | Why They Pay |
|---|---|
| Wallets and broker apps | Add defined-outcome products without building issuance, disclosure, settlement, and mandate infrastructure |
| Tokenized stock platforms | Move from spot-only trading to higher-margin structured products on the same assets |
| RWA issuers and structured-product desks | Launch repeatable payoff templates with anchored terms, receipts, and lifecycle audit trails |
| Market makers / liquidity providers | Distribute payoff profiles with deterministic settlement and visible collateral requirements |
| Agent platforms | Route financial agent actions through signed mandates instead of giving agents unrestricted wallet access |
| Revenue Line | Trigger | Why It Is Defensible |
|---|---|---|
| Issuance fee | Product created and listed | Contour supplies payoff templates, registry, disclosure anchoring, activation gates, and vault wiring |
| Subscription fee | User enters a product | Contour handles accounting, position minting, suitability gating, and policy checks |
| Agent execution fee | Mandate-gated action is broadcast | Users/platforms pay for constrained automation, not unconstrained agent custody |
| Lifecycle servicing fee | Oracle update, activation, settlement, claim, reporting | Structured products require ongoing servicing after entry |
| Audit API fee | Distributor or issuer pulls receipts/reports | Compliance-grade data is reusable across dashboards and reviews |
| Platform integration fee | Wallet, broker, RWA issuer, or market maker integrates Contour | Contour becomes embedded product infrastructure |
Contour's wedge is the verifiable financial control plane around tokenized-asset product execution:
- who authorized it
- what limits applied
- what product terms were active
- why the product was allowed to launch
- what market data was used
- which documents were disclosed
- why the chain rejected the agent when it exceeded policy
The durable product is the policy-constrained workflow layer that makes financial agents deployable.
The core Contour foundation is already live on Robinhood Chain Testnet: payoff templates, canonical products, vault funding, ERC-721 position tokens, oracle settlement, disclosure anchoring, EIP-712 mandates, PolicyGuard limits, and agent-coordinated execution. The backend services handle market-data pricing, Alchemy-sponsored broadcasts, oracle updates, lifecycle servicing, IPFS receipts, and wallet-scoped activity streams. The frontend completes the investor flow with marketplace discovery, product pages, suitability signing, mandate signing, USDG approval, sponsored subscription, portfolio tracking, claims, Contour Auto, mandate revocation, and transaction receipts.
Expand beyond the shipped AMD, AMZN, TSLA, and NFLX products into a broader Robinhood Chain tokenized-equity shelf.
- Add more single-stock references across large-cap technology, consumer, financial, and index-adjacent names
- Support richer maturity ladders: short demo tenors, weekly products, monthly products, and issuer-defined terms
- Let issuers configure product size, risk level, min/max subscription, buffer, cap, coupon, and participation within protocol-approved bounds
- Keep every new product on the same rails: immutable termsheet, disclosure hash, funded collateral, oracle lifecycle, ERC-721 position, and USDG settlement
This turns Contour from four canonical demo products into repeatable structured-product infrastructure for Robinhood Chain tokenized equities.
Extend the current Buffered Upside and Reverse Convertible templates into a larger payoff library.
- Principal-protected notes for users who want upside exposure with defined capital protection
- Yield-enhanced range products for sideways markets
- Autocallable-style products with scheduled observation dates and early redemption logic
- Multi-asset basket products referencing several tokenized equities inside one structured position
- Reusable payoff modules so new templates inherit the same vault, disclosure, mandate, oracle, and settlement flow
The goal is not just more products. It is a standard way to launch new structured payoff families without rebuilding compliance, custody, disclosures, settlement, or agent controls each time.
Turn agent onboarding into a market primitive.
- Third-party agents can register through Contour's agent registries with role, scope, metadata, and verification status
- Agent reputation can be built from completed actions, failed policy checks, lifecycle receipts, and user outcomes
- Agents can specialize by role: suitability, execution, risk review, disclosure generation, oracle servicing, or portfolio rollover
- AgentServiceEscrow can support paid agent jobs while PolicyGuard keeps fund-moving authority bounded by user mandates
- ERC-8001-style coordination lets agents participate in multi-step workflows without blurring who approved what
This creates an open but controlled agent market: agents compete on service quality, while users and issuers still get onchain limits, receipts, and revocation.
Unlock servicing beyond initial minting and hold-to-maturity.
- Position splitting so one ERC-721 structured-product position can be separated into smaller transferable units
- RFQ exits so users can request early liquidity before maturity instead of waiting for settlement
- Market-maker quote rails for bid/ask pricing on live structured-product positions
- Issuer dashboards for product funding, outstanding notional, maturity exposure, claim status, and secondary-market activity
- Transfer-aware servicing so disclosures, claim rights, activity history, and settlement logic follow the position through its lifecycle
This moves Contour from primary issuance into a full structured-product market: mint, service, transfer, quote, exit, settle, and audit.
Contour's long-term goal is to become the programmable structured-product layer for tokenized markets.
Any tokenized asset on Robinhood Chain can become the reference asset for a defined-outcome product. Approved agents operate inside protocol policy. Users subscribe with clear disclosure, bounded authority, sponsored execution, and verifiable settlement.
Tokenized assets become programmable financial products, serviced by constrained agents and settled transparently onchain.